Is there a way to modify SID for alerting searches?

[budkial]

Hi,

I'm running alerts on quite a few scenarios across JVMs and servers and clusters to make sure logging is performing as expected.

The webhook works great, but it is painful to sort the alerts based on the SIDs generated by Splunk. Is there a way so set the SIDs for the alerting searches such that they are human readable and easier to parse?

[budkial]

To clairfy, I'm looking for something I can add to the searches generating the alerts that allows me to give them human readable IDs. One example would be setting the SID to ProdAlert1.

I'm also open to other ways of injecting information into the JSON returned.

[sbbadri]

I don't know whether you can override SID. But you can sort SID

| rest /services/search/jobs | where isSavedSearch=1 | table latestTime sid label

Check below link,

http://docs.splunk.com/Documentation/Splunk/6.6.2/RESTREF/RESTsearch#search.2Fjobs

[budkial]

That is interesting, but I'm not looking to pull the SIDs from splunk, the SID is in the JSON